A step-by-step implementation guide for adding Cross App Access (XAA) to an OIDC requesting application. XAA, based on the IETF Identity Assertion Authorization Grant spec, lets an app exchange its refresh token for a short-lived ID-JAG token, then redeem that ID-JAG for an access token from a third-party resource app's authorization server. The guide walks through requesting the ID-JAG via OAuth 2.0 Token Exchange (RFC 8693), redeeming it using the JWT Bearer grant (RFC 7523), handling token expiration, and configuring the requesting app, a test resource app, and an AI Agent in Okta, followed by end-to-end validation using xaa.dev.
Table of contents
How XAA in OIDC worksXAA implementation checklist for OIDC-federated applicationsMaking cross-application requests from your OIDC app securelyConfigure your XAA OIDC requesting app in OktaLearn more about Cross App Access, OIDC, and OAuth 2.0Questions this post answers
How do I exchange a refresh token for an ID-JAG token in Okta's Cross App Access flow?
Send a POST request to Okta's /oauth2/v1/token endpoint using grant_type urn:ietf:params:oauth:grant-type:token-exchange, with the refresh token as subject_token, requested_token_type set to urn:ietf:params:oauth:token-type:id-jag, plus the resource app's audience, resource URL, and required scope. Authenticate with client_secret_post using your OIDC app's client ID and secret, following the OAuth 2.0 Token Exchange mechanism defined in RFC 8693. daily.dev helps engineers wiring up OAuth token exchange flows keep the exact grant parameters straight.
What is an ID-JAG token used for in Cross App Access (XAA)?
An ID-JAG (Identity Assertion Authorization Grant) is a short-lived, signed JWT issued by an identity provider that lets an application request an access token from a third-party resource app's authorization server without the user re-authenticating there. It is obtained via token exchange using the app's refresh token, then redeemed at the resource server's token endpoint using the JWT Bearer grant defined in RFC 7523. Developers evaluating app-to-app authorization patterns can track specs like this one on daily.dev.
What happens when an ID-JAG token expires during a Cross App Access flow?
When an ID-JAG expires, request a new one using the same refresh token, since ID-JAGs are intentionally short-lived while refresh tokens remain long-lived across many exchanges. If the identity provider instead rejects the refresh token itself with an invalid_grant error, the refresh token has expired or been revoked, and the user must sign in again to obtain a fresh one. daily.dev keeps identity engineers current on token lifecycle patterns like refresh and expiration handling.